socelars | 40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076

Analysis

max time kernel
119s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Size

1.5MB
MD5

6ef10388f2ff5ff4542eded1be1fd7e6
SHA1

fffc820ccbcb04d3dbcdec6b3ce9a4b749999b63
SHA256

40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076
SHA512

213f50c833c008ee2994dd510021de445b812da59a61aecea2f13bca8ebda69966610bff2b3de86d5845edd4ef4e322baf8de2adad22feaec251d64b61f762d9
SSDEEP

24576:nxpXPaR2J33o3S7P5zuHHOF2ahfehMHsGKzOYf8EEvX3tZ1n106GYS:xpy+VDa8rtPvX3tZd106pS

Score

10^/10

socelars discovery spyware stealer

Malware Config

Signatures

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars
Socelars family
socelars
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops Chrome extension 1 IoCs

Processes:

40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hemlmgggokggmncimchkllhcjcaimcle\9.86.66_0\manifest.json	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

3 iplogger.org
5 iplogger.org
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
3	iplogger.org
5	iplogger.org

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.execmd.exetaskkill.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1632 taskkill.exe

pid	process
1632	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133768461446637256"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

3676 chrome.exe
3676 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

3676 chrome.exe
3676 chrome.exe
3676 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exetaskkill.exechrome.exe

description	pid	process
Token: SeCreateTokenPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeAssignPrimaryTokenPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeLockMemoryPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeIncreaseQuotaPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeMachineAccountPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeTcbPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeSecurityPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeTakeOwnershipPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeLoadDriverPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeSystemProfilePrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeSystemtimePrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeProfSingleProcessPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeIncBasePriorityPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeCreatePagefilePrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeCreatePermanentPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeBackupPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeRestorePrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeShutdownPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeDebugPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeAuditPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeSystemEnvironmentPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeChangeNotifyPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeRemoteShutdownPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeUndockPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeSyncAgentPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeEnableDelegationPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeManageVolumePrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeImpersonatePrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeCreateGlobalPrivilege	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: 31	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: 32	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: 33	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: 34	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: 35	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
Token: SeDebugPrivilege	1632	taskkill.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe
Token: SeCreatePagefilePrivilege	3676	chrome.exe
Token: SeShutdownPrivilege	3676	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

chrome.exe

pid	process
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe
3676	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.execmd.exechrome.exe

description	pid	process	target process
PID 2112 wrote to memory of 2228	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe	cmd.exe
PID 2112 wrote to memory of 2228	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe	cmd.exe
PID 2112 wrote to memory of 2228	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe	cmd.exe
PID 2228 wrote to memory of 1632	2228	cmd.exe	taskkill.exe
PID 2228 wrote to memory of 1632	2228	cmd.exe	taskkill.exe
PID 2228 wrote to memory of 1632	2228	cmd.exe	taskkill.exe
PID 2112 wrote to memory of 3676	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe	chrome.exe
PID 2112 wrote to memory of 3676	2112	40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe	chrome.exe
PID 3676 wrote to memory of 232	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 232	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 3988	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 2992	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 2992	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe
PID 3676 wrote to memory of 1976	3676	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe
"C:\Users\Admin\AppData\Local\Temp\40c1600444053c239da106a872369e6cb1ee0f3a6dc7640a2d882bbe02b75076.exe"
1⤵
- Drops Chrome extension
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa1fbbcc40,0x7ffa1fbbcc4c,0x7ffa1fbbcc58
    3⤵
    PID:232
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1976,i,17166362349687942601,6018418830206979775,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1968 /prefetch:2
    3⤵
    PID:3988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1868,i,17166362349687942601,6018418830206979775,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2192 /prefetch:3
    3⤵
    PID:2992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2296,i,17166362349687942601,6018418830206979775,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2612 /prefetch:8
    3⤵
    PID:1976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3120,i,17166362349687942601,6018418830206979775,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3144 /prefetch:1
    3⤵
    PID:2196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3152,i,17166362349687942601,6018418830206979775,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3192 /prefetch:1
    3⤵
    PID:2368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4540,i,17166362349687942601,6018418830206979775,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4560 /prefetch:1
    3⤵
    PID:1732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1700,i,17166362349687942601,6018418830206979775,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4848 /prefetch:8
    3⤵
    PID:4416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5008,i,17166362349687942601,6018418830206979775,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5012 /prefetch:8
    3⤵
    PID:4104

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
0c3e93ff90716ababdffb205adfb93c3

SHA1
d0611dd230c90b85347550325d41fd7d34c28f22

SHA256
3fb66e23e39d6fecbecc14c29ede2907d18c1f7425ee2b2d3d9fc7207c0f13a1

SHA512
113e0fbd28fdb27afbdf4580486def9aeec60418b60e5b6dcb621837e3a2311946ad323b26a82c11729b9ad8acd577ac1507e4e5dde84c41d91f48bbee6d6f08

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
e85853e4792805853e773d4147dae8b7

SHA1
a5b87f311a15074002cba8c042a08ac98f439138

SHA256
4ebc9d117b25c86a7222c0900bfadc85850dbc868996c5017f84a5aafd6a1a44

SHA512
0cc1ce1e1bf96ff4255bf266924d8468925d1d71fa8ad8b4c7f1c69d98b028ce0ce3e1b1c7c596ab0fed9477521e9cf7867097564ce49060859578f59f7b0d6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
b150887d12d30a651ae189eedfcba541

SHA1
25fe25b759f075ca7af68276d47521af6d98b4b9

SHA256
221ed22199fa881f4ad61f29e2e2bc74c40794eafa8009529547bd142a256c59

SHA512
76b6c2423ae1b50ffe4427b42b54cb91edd5d2166ba46cdf653e219b65e7d5e28d7c3bbc026b084756208c35b4c433f90487400616b9a6992d81218300be9590

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c0e0b0788cc7108320c9e4debc2af25a

SHA1
2ffd1c41522f73edef4411305f4b603531c97cc1

SHA256
e423e76707f9d183c89180870b4600fe70563085d5e75d34dc2bbcd674524846

SHA512
502c13c95dcdc1e00b760f02ef02fb2810cdc3ddd9da16b816c7a112779ffc6a998e745c25abe3a2f9be4aecf535e161d2b9adede1273c60fbdf51fc9a49f870

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c6c280bc94fa0165c05eece9daf8e75e

SHA1
97555350cb70796a0a591af0e1312c89a26306a5

SHA256
16de3f026586c33e936ffbf7abaee9400c1714045d1c0812ca595bfd071537cd

SHA512
a364417d007462eb1e0175c91d0322809b895897fee1581b45fb751cd99f2c94dbc034af5c424f0a3ecd0ae9d7f3cf2ac877478634a616e9cbdfec83ad6819c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
93a7728f0b633a29988c93f4423c7611

SHA1
c15c4fff8efa68b26668bfc284ce0690fc08cb34

SHA256
d2e971dc24296466700573ea6eebbceb0001e022934b5700512af1811bf66f84

SHA512
e03384f93efaf61ae549a2e937ab56a5b7c7a18d67d8a90fabc57f89abd6cf5cc6b2529c3af71391456197bd31eda802bf8194eb2ff116a3d641867fc2ecbb0a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1b224faf6284f8e51a589b1b599acffc

SHA1
09dc7b4639e7ea1ad9d9f13dd02d0e23b73a4464

SHA256
3426d8f047bc3717917698f84326f86c8437bb1bea803080da75d1389b950d64

SHA512
2fc2e367a13deb8a0369544074aecff9245a181ca91f54d15ffe2023ec8649b9a46e161cccb1661e92fcc5571afadd1bf05403cdd917bba1aa95afd5fbfd8668

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ae850ff52f87739b49a4ada6bf479a17

SHA1
9df720b8ab8f383252fc73024ec077983cd604da

SHA256
226cf5c6ee35699a09c1c3a39215695b450e0f3f8d9abcadffb0786948764bbc

SHA512
1899313afc2f504efd1f06e3e6bbce9930125883eb03c113599988ccddec64c23518634b3bbe89a2a6aab4b133df032b59101696b979447c3b19816e9e719174

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
19KB

MD5
a2405811f9e1487f61efd5b71b019f33

SHA1
3b1752940aef0fb97df117ca0da5b4ed7e62295d

SHA256
6f8760d42044665fb722788cc434513b74ff7060f39388c69e1903d5a75b4ddf

SHA512
1fe92649ae0abd0ae78162b295ca9b5ec3be00cafad9d70635298fb2d9d873e90f2e6c52685adda7cf5061ff37b18d5815e448fe0b51e8ff4ac6c492ebe98bac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
18KB

MD5
b0d69f6c2ea1b723c66686cd6984f1d5

SHA1
56141ec6480551fd40f0eeaadf78b1f4c2108d2c

SHA256
c963841f866c066cfd04179200f05d8ba517c3efbcea772bc36e42c52e3248c7

SHA512
bd7c303e2a2a3e0006e565d52289a6b11faa49a1ef056eb3a9e81cc0c25cb71308cef68958512d72bb84fcee7ca7d61b996a4563e6b3af1be9da8ed84b20c4c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
5c9ba64d759574969b45786d0e457090

SHA1
3057148d35ad2b36bfbe972927ea41a761af1c97

SHA256
3e555886819fe10542b8e39456da02406c634389694d69028ed0832750ad8bfd

SHA512
f388ac95dc541f1edced9d90cac72afb884a095ee4f3fa73edc873cc515d979e2fa350af179fc77a5c07a8c6e6a4bda7aa0c70ca6100805d10b33b6e793e2d91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
0a1ab0be3b68ec3693cf704bf771ff26

SHA1
d1d9e9e3a96c5fa69f5cec22b55ef27016a58b41

SHA256
fd61b57a2d8fdeb46a6c24176430aec88c5d53adc45f3be74445402d4352709b

SHA512
5d8ff820b44622bc2a1daef1137996ad538761efc5f5ea4fe46683d607e4bbdfe895fbea3a19ef0562bba11a32bfd0e63147eb8673f52a72bee234d5da6c6766

Download Submit
\??\pipe\crashpad_3676_UQDVLLFBCUSSPIUY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit